# Get values from nested JSON

**URL:** <https://discuss.elastic.co/t/get-values-from-nested-json/221423>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 28, 2020, 12:06pm UTC](https://discuss.elastic.co/t/get-values-from-nested-json/221423 "2020-02-28T12:06:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sumgan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sumgan/32/47196_2.png) [@Sumgan](https://discuss.elastic.co/u/Sumgan)\
**Post date:** [February 28, 2020, 12:06pm UTC](https://discuss.elastic.co/t/get-values-from-nested-json/221423/1 "2020-02-28T12:06:59Z")

</div>

Trying to parse by filebeat JSON-log like:  
{  
"Date": "2020-02-28T07:16:32.140133Z",  
"Level": "Trace",  
"Message": "SLOW QUEUE MSG [{queue}]: {message} - {elapsed}ms. Q: {prevQueueCount}/{curQueueCount}.",  
"EventProperties": {  
"queue": "StorageWriterQueue",  
"message": "WritePrepares",  
"elapsed": 1685,  
"prevQueueCount": 0,  
"curQueueCount": 0  
}  
}

Output gives _EventProperties.queue_ _EventProperties.elapsed_ as stand-alone fields

Is there any way to set this field values into  
`"Message": "SLOW QUEUE MSG [{queue}]: {message} - {elapsed}ms. Q: {prevQueueCount}/{curQueueCount}.",`

to get:  
`"Message": "SLOW QUEUE MSG ["StorageWriterQueue"]: "WritePrepares" - 1685ms. Q: 0/0.",`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2020, 12:07pm UTC](https://discuss.elastic.co/t/get-values-from-nested-json/221423/2 "2020-03-27T12:07:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.